Archive for the 'Twitter' Category

Paper.li is a web service that let’s members create a daily newspaper of sorts containing their favorite material that they then sharing it with their followers. Here are some points that the investigator should note:

Paper.li is a content curation service. A Content Curator is someone who continually finds, groups, organizes and shares the best and most relevant content on a specific issue online. These sites are a good place to find content deleted from the originating social networking site.

If you go to Paper.li and use their search feature, you won’t find anything unless your search is for the title of a paper. Their search doesn’t look within individual articles.

To find mentions of content from Twitter, or any other content, use the Site: operator. When using this search strategy, search by the Twitter account’s name and the user name (@username) along with any keywords that might apply to what you are looking for.

Fortunately for investigators, Twitter does not provide bulk deletion. This means that most people will not take the time to examine their Tweets for Bozo Eruptions. However, batch deletions are possible, by using third-party sites like Tweet Deleter, Tweet Eraser and TwitWipe. If someone deletes some Tweets, Twitter admits that “Deleted tweets sometimes hang out in Twitter search, [but] they will clear with time.” Unfortunately, when a user deletes a tweet, it eventually disappears from Twitter’s search results, as well as from any accounts that follow the account along with any retweets of the deleted tweet.

Fear not intrepid investigator, fore hope and a lot of searching might uncover someone who copied into his own tweet a deleted tweet, which will remain as will any tweets quoted on sites elsewhere.

Shooting down a passenger jet has exposed some good old-fashioned Soviet-style propaganda. It’s not as good as some of Putin’s efforts, but it’s interesting to watch.

The Wayback Machine has captured some very interesting evidence that Russian-backed terrorists shot down Malaysia Airlines Flight MH17. In a post by Igor Girkin on Vkontakte, Russia’s Facebook clone, the Ukrainian terrorist leader who is also known as Strelkov, claimed his forces downed what he thought was a Ukrainian military transport plane.

Meanwhile over at Wikipedia, the Twitter account @RuGovEdits monitors Wikipedia edits by the Russian government. It reveals Russia’s efforts to shift the blame to the Ukrainian government. Putin’s office and Russian media outlets made multiple edits to the page for the murder of the MH17 passengers to blame the “Ukrainian military”. @RuGovEdits should be trustworthy as the Wiki-twitterbot code is widely available on Github.

During research projects I sometimes come across astounding levels of stupidity posted for all to see. Sometimes this occurs in obscure corners of the interweb, sometimes it’s done on Twitter.

If I think an instance of stupidity might become important in the future, I manually archive the web page or Tweet by submitting it to the Wayback Machine using the Save Page Now option.

This doesn’t work with all sites, but when it works, the “Bozo Eruption” will be available on an authoritative site in the future. There won’t be any question that the eruption occurred if someone has second thoughts and removes it from the site.

Events create a lot of social media chatter. Within this chatter or noise, the Investigator must find useful data. If the origin of the investigation is an event at a particular location, then searching for chatter that is related to the location may move the investigation forward.

GeoTagging is the process of adding geographical identification metadata to social media messages and other content such as images. Searching by the location usually entails entering the Latitude and Longitude of the location.

Twitter Geotags

Twitter Nano

Twitter Nano allows me to improve the signal-to-noise ratio when the starting point is an event or situation that I can identify with Latitude and Longitude. This will allow the Investigator to identify the people who have an interest or involvement in the event under investigation.

Of course, this doesn’t work if the user-of-interest hasn’t enabled geotagging. However, those with geotagging enabled often identify others who don’t have it enabled.

Lately, I have been working with clients who face serious security threats. Some of these people are surprised by what can be learned about them from internet searches. Removing this information is a challenge, especially from social media sites like Twitter.

Twitter presents an interesting challenge. Once you publish a Tweet, a lot of other websites take your Tweet and reproduce it in a database. Topsy, Snap Bird, the Library of Congress, and many others get in on the act.

Of course, you can delete your Twitter account, but your Tweets will live on in a third party database.

The best solution that I have found is to remove all the Tweets from your account rather than deleting the account itself. When some third party site comes to collect your tweets to update their database, they also overwrite or delete your old Tweets and replace them with nothing matching the empty Twitter profile.

Doing this also prevents some malicious adversary from waiting thirty days then opening a new account using your deleted Twitter account name. Of course, keeping the account also allows you to start using it for some subtle disinformation.

If your Twitter account has thousands of Tweets like mine does, then you need an automated deletion service.

After thirty days, you should start searching for the deleted Tweets to identify any sites that still have them. If they still exist on some sites after sixty days, then consider requesting their removal.

If you want to see all the Tweets from a particular Twitter account, then you are out of luck if you don’t know about Snap Bird. Twitter allows you to only search or see about a week’s worth of Tweets.

Snap Bird allows you to survey all the Tweets for a particular user if you select “Someone’s timeline” as the type of search.

This is extremely useful when trying to assess the nature of the person behind the Twitter account. Sometimes, you will find that the account is really just a bot that retweets what it finds. Sometimes, you find the account is owned by somebody with an axe to grind. Sometimes, you find the person behind the account is an activist of some type. You learn these things from reviewing all the tweets to see the general theme of the account.

The point is, you won’t know what you’re dealing with unless you can see all the Tweets coming from that account and Snap Bird allows you to do that.

One of my favourite search engines for Twitter is Topsy which indexes and ranks search results based upon the most influential conversations occurring every day about each specific term, topic, page or domain queried.

I have been using this for almost two years as my go-to search engine for tweets about issues that currently interest my clients.

To monitor someone’s Tweets, but not actually publicly follow the Twitter account, use Twitter to RSS. This service allows you to enter the name of a public Twitter account and create an RSS feed for popular RSS readers like Google Reader.

This won’t work if the account owner selected the Protect my tweets box in the account settings.

If you provide a location in your Twitter profile settings, then following @topix_local will get you tweets about the location. To stop getting alerts, simply stop following @topix_local. This needs a city name in your profile settings to be effective so that it picks-up the hashtag (#city).

UPDATE: You won’t get very many Tweets using @topix_local compared to using TweetDeck and creating a column for #City. But of course, in TweetDeck, you will get everything with the city hashtag, whether it’s news or not.